The Refrigeration Attacks Were Not Clever. That Is the Problem.
Josh Bahlman9 min read
Exposure did not add one risk to the register. It multiplied every risk already on it.
This week I looked at the supermarket refrigeration attacks across Europe. Up to 700 French stores on 11 October, then Ireland, Sweden, Italy, Estonia and others three weeks later. Cases run to 50°C overnight. Stock in skips. Some units on fire.
Everyone wants it to be sophisticated. It is not. No zero days. No AI. Controllers on the public internet, a password derived from the date, end-of-life firmware with a fix available since August 2025, and a field bus that trusts whatever the controller tells it.
That is the uncomfortable part. A clever attack you can forgive. This one needed nothing we did not already know about. Each gap had been found, rated and parked. An old controller, medium. An exposed interface, medium to high. A known bypass, high but unlikely. Nobody rated the chain. The low likelihood on the inside was borrowed from the perimeter, and the perimeter was not there.
So here it is in one view. A typical store refrigeration estate and the hop that broke it. The assumed attack chain, based on what is public so far. The key vulnerabilities in the affected controllers. The controls that would have broken the chain at each step. And the risk takeaway: four acceptable rows that added up to one critical one.
Current as of 4 November. Tell me what I have wrong.
European supermarket refrigeration hacks · Current as of 4 November 2026
A real-world view of the architecture, the assumed attack chain and where the risk emerges.
Status as at 4 November 2026
What happened
Mar 2025
Danfoss discloses a date-derived password bypass in the AK-SM 800A (CVE-2025-41450, found by Claroty Team82).
Aug 2025
Danfoss 4.3.1 closes command injection and configuration DoS (CVE-2025-41451 and 41452). Only unpatched units stay exposed.
26 Feb 2026
CISA advisory ICSA-26-057-10: Copeland XWEB Pro 1.12.1 and earlier. Two authentication bypasses, two command injections.
11 Oct 2026
Overnight defrost attack across up to 700 French stores, with spillover in the Netherlands and Belgium. Cases reach about 50°C. Losses in the tens of millions of euros.
12 Oct 2026
CERT-FR alert CERTFR-2026-ALE-012. ANSSI coordinates the response with other European authorities.
2 to 3 Nov 2026
Second wave: Sweden, Belgium, Luxembourg, Ireland, Italy, Estonia, Greece. Same controller families. No attribution.
A typical store refrigeration estate
Attack pathStore connectivity
Inside the store rated as "internal access required"
Store network IT, or a dedicated OT segment
Threat actor Scans for exposed management interfaces and exploits known weaknesses.
Internet
Firewall / router Direct access or port forwarding
Supervisory controller Danfoss AK-SM 800A or AK-SC 355, Copeland or Dixell XWEB Pro Web interface, alarms, schedules, setpoints, user management
Command injection after login
Field bus with no authentication
Alarms raised by the same box
Default and shared logins
Refrigerated display cases Field controllers: temperature, defrost, fans, lighting
Chillers and condensing units Field controllers: compressors, fans, alarms
Cold rooms Field controllers: setpoints, defrost cycles, door sensors
RS-485 / Modbus or similar field bus
exposed
Root failure: the controller is reachable from the internet. Its own web server sits on standard ports, direct or port-forwarded through the store router. Everything inside the dashed box was rated as if an attacker first had to get into the store. This one hop removes that assumption for all of it at once.
Exposure on its own
A login page on the internet. Rated medium. "It still needs a password."
×
Internal weaknesses on their own
Command injection after login. A field bus with no authentication. Alarms on the same controller. Rated low. "You would have to be inside the store."
=
Together
Remote, unauthenticated control of every case, cold room and compressor in the store, and of the alarms that would have told you. Critical. Repeatable in every store built the same way.
The low likelihood on the inside was borrowed from the perimeter. Take the perimeter away and the whole column re-rates at once. Exposure does not add one risk to the register. It multiplies every risk already on it.
Assumed attack chain
based on what we know so far
01
Reconnaissance
Scan for internet-exposed refrigeration management interfaces (Shodan, Censys, targeted scanning). Thousands of controllers answer.
02
Gain initial access
Log in with default, weak or predictable credentials, or bypass authentication outright (CVE-2025-41450 date-derived password; CVE-2026-25085 and CVE-2026-21718 on XWEB Pro).
03
Escalate and execute
Authenticated access is already enough to change settings. Command injection adds code execution on the controller (CVE-2025-41451; CVE-2026-24663 and CVE-2026-21389).
04
Manipulate operations
Force defrost mode, raise setpoints, rewrite schedules and suppress alarms. Overnight, when the store is empty and nobody is watching.
05
Impact
Cases run far outside safe limits: about 50°C after six hours, 80°C in one store. Stock spoils. Some units overheat and catch fire. Losses run to tens of millions of euros.
Key vulnerabilities
Danfoss AK-SM 8xxA before 4.3.1
CVE-2025-41450
Authentication bypass. Admin password derived from the device date and time. CVSS 8.2.
CVE-2025-41451
OS command injection via alarm-to-mail fields. Authenticated remote code execution. CVSS 8.7.
CVE-2025-41452
Web interface configuration manipulation. Denial of service. CVSS 6.8.
Fixed in 4.3.1 (Aug 2025). AK-SC 355 (end of life 2016) and AK-SM 800 non-A (end of life 2021) get no fix. Replace them.
Copeland / Dixell XWEB Pro 1.12.1 and earlier
CVE-2026-25085
Authentication bypass on XWEB 300D, 500D and 500B Pro.
CVE-2026-21718
Authentication bypass through broken cryptography. Pre-auth code execution. CVSS 10.0.
CVE-2026-24663, CVE-2026-21389
OS command injection through the web interface.
CISA ICSA-26-057-10 (Feb 2026). Fix: the latest XWEB Pro release. Older XWEB controllers are discontinued.
Exposure and access in practice
Public exposure
Each controller runs its own web server. Hundreds sat directly on the internet in France alone. Thousands more across Europe were still reachable after the first wave.
Remote maintenance
Store operators and refrigeration contractors use the interface for monitoring, support and configuration, mostly from outside the store.
Network placement
Often directly internet-facing. Sometimes behind a VPN. Sometimes port-forwarded through the store router on 443 or 80.
Patching
Fixes exist: Danfoss 4.3.1 and the latest XWEB Pro release. Much of the estate is end of life, contractor-managed and tied to third-party integrations, so it never gets them.
Where controls break the chain
Remove public exposure
VPN or private connectivity for remote access. No direct internet reach to the controller.
Strong authentication
Remove default and predictable credentials. MFA at the remote access layer. Role-based access on the controller.
Network segmentation
Isolate refrigeration OT from corporate IT and from the internet.
Monitor for changes
Alert on setpoint changes, defrost commands and configuration activity, especially out of hours.
Patch or replace
Current firmware on supported units. End-of-life controllers replaced, not risk-accepted.
Independent validation
Temperature sensors and physical checks that do not trust the controller's own readings.
The risk takeaway
Individually, each issue looked manageable.
An ageing OT controller?Medium risk.
An exposed interface?Medium to high.
An authentication bypass?High, but rated unlikely.
A refrigeration failure?An operational risk with a response plan.
Connect them into an attack chain and the likelihood and the business impact change together. That is a much larger risk picture than any static, isolated register will ever show.
